@markstanden/opencode-test-container 0.0.0-stage → 0.1.0

package/dist/adapters/opencode/runtime.d.ts

@@ -0,0 +1,87 @@
+import type { Arm, Campaign } from "../../contracts/types.ts";
+/** One plugin entry handed to OpenCode. */
+export interface PluginEntry {
+    /** The package value. */
+    package: string;
+    /** The options value. */
+    options?: unknown;
+}
+/** The OpenCode configuration OTC writes for one arm. */
+export interface OpencodeConfig {
+    /** The schema value. */
+    $schema: string;
+    /** The model value. */
+    model: string;
+    /** The plugins value. */
+    plugins?: PluginEntry[];
+    /** The permissions value. */
+    permissions?: Record<string, unknown>;
+}
+/**
+ * Build the arm's non-secret OpenCode configuration.
+ * @param campaign The normalised campaign.
+ * @param arm The selected arm.
+ * @returns The configuration object written into the read-only config home.
+ */
+export declare function opencodeConfig(campaign: Campaign, arm: Arm): OpencodeConfig;
+/**
+ * The exact `opencode run` argv. This is the argv recorded in evidence and
+ * the argv actually spawned.
+ * @param options Model route, title, prompt and logging choice.
+ * @returns The complete argv (without the binary).
+ * @param options.model The model value.
+ * @param options.title The title value.
+ * @param options.prompt The prompt value.
+ * @param options.printLogs The printLogs value.
+ */
+export declare function opencodeRunArgs(options: {
+    model: string;
+    title: string;
+    prompt: string;
+    printLogs?: boolean;
+}): string[];
+/**
+ * The provider overlay passed inline through `OPENCODE_CONFIG_CONTENT`. Only
+ * non-secret routing belongs here; credentials travel by environment name.
+ * @param campaign The frozen campaign.
+ * @returns JSON text, or null when the campaign declares no overlay.
+ */
+export declare function providerOverlay(campaign: Campaign): string | null;
+/**
+ * Write the read-only config home for one arm: its OpenCode configuration.
+ * Skill bundles are staged into the same tree by the trial runner.
+ * @param trialDirectory The trial's private directory.
+ * @param campaign The normalised campaign.
+ * @param arm The selected arm.
+ * @returns The config-home path.
+ */
+export declare function writeConfigHome(trialDirectory: string, campaign: Campaign, arm: Arm): string;
+/**
+ * Write the judge's neutral config home: no skills, no plugins, only the
+ * judge model route. The judge never sees an arm's staged subjects.
+ * @param directory The attempt directory.
+ * @param campaign The frozen campaign.
+ * @param model The judge model route.
+ * @returns The config-home path.
+ */
+export declare function writeJudgeConfigHome(directory: string, campaign: Campaign, model: string): string;
+/**
+ * Environment for one headless session. Ambient OpenCode session identity is
+ * removed; credentials and routing arrive only through declared names.
+ * @param base The host environment.
+ * @param options Config home, trial data/cache directories, overlay and names
+ *   whose values are passed through.
+ * @returns A fresh environment object.
+ * @param options.configHome The configHome value.
+ * @param options.dataHome The dataHome value.
+ * @param options.cacheHome The cacheHome value.
+ * @param options.overlay The overlay value.
+ * @param options.passthrough The passthrough value.
+ */
+export declare function sessionEnv(base: NodeJS.ProcessEnv, options: {
+    configHome: string;
+    dataHome: string;
+    cacheHome: string;
+    overlay: string | null;
+    passthrough: readonly string[];
+}): NodeJS.ProcessEnv;

package/dist/adapters/opencode/runtime.js

@@ -0,0 +1,136 @@
+import { mkdirSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+/**
+ * Build the arm's non-secret OpenCode configuration.
+ * @param campaign The normalised campaign.
+ * @param arm The selected arm.
+ * @returns The configuration object written into the read-only config home.
+ */
+export function opencodeConfig(campaign, arm) {
+    const config = {
+        $schema: "https://opencode.ai/config.json",
+        model: campaign.runtime.provider.model,
+    };
+    if (arm.plugins !== undefined && arm.plugins.length > 0) {
+        config.plugins = arm.plugins.map((plugin) => ({
+            package: `/subjects/plugins/${plugin.id}`,
+            ...(plugin.options === undefined
+                ? {}
+                : { options: plugin.options }),
+        }));
+    }
+    if (campaign.permissions !== undefined) {
+        config.permissions = campaign.permissions;
+    }
+    return config;
+}
+/**
+ * The exact `opencode run` argv. This is the argv recorded in evidence and
+ * the argv actually spawned.
+ * @param options Model route, title, prompt and logging choice.
+ * @returns The complete argv (without the binary).
+ * @param options.model The model value.
+ * @param options.title The title value.
+ * @param options.prompt The prompt value.
+ * @param options.printLogs The printLogs value.
+ */
+export function opencodeRunArgs(options) {
+    return [
+        "run",
+        "--standalone",
+        "--auto",
+        "--archived",
+        "--title",
+        options.title,
+        "--model",
+        options.model,
+        "--format",
+        "json",
+        ...(options.printLogs === true ? ["--print-logs"] : []),
+        options.prompt,
+    ];
+}
+/**
+ * The provider overlay passed inline through `OPENCODE_CONFIG_CONTENT`. Only
+ * non-secret routing belongs here; credentials travel by environment name.
+ * @param campaign The frozen campaign.
+ * @returns JSON text, or null when the campaign declares no overlay.
+ */
+export function providerOverlay(campaign) {
+    const overlay = campaign.runtime.provider.overlay;
+    return overlay === undefined ? null : JSON.stringify(overlay);
+}
+/**
+ * Write the read-only config home for one arm: its OpenCode configuration.
+ * Skill bundles are staged into the same tree by the trial runner.
+ * @param trialDirectory The trial's private directory.
+ * @param campaign The normalised campaign.
+ * @param arm The selected arm.
+ * @returns The config-home path.
+ */
+export function writeConfigHome(trialDirectory, campaign, arm) {
+    const configHome = join(trialDirectory, "config-home");
+    const opencode = join(configHome, "opencode");
+    mkdirSync(join(opencode, "skills"), { recursive: true });
+    writeFileSync(join(opencode, "opencode.json"), `${JSON.stringify(opencodeConfig(campaign, arm), null, 2)}\n`, "utf8");
+    return configHome;
+}
+/**
+ * Write the judge's neutral config home: no skills, no plugins, only the
+ * judge model route. The judge never sees an arm's staged subjects.
+ * @param directory The attempt directory.
+ * @param campaign The frozen campaign.
+ * @param model The judge model route.
+ * @returns The config-home path.
+ */
+export function writeJudgeConfigHome(directory, campaign, model) {
+    const configHome = join(directory, "config-home");
+    const opencode = join(configHome, "opencode");
+    mkdirSync(opencode, { recursive: true });
+    writeFileSync(join(opencode, "opencode.json"), `${JSON.stringify({
+        $schema: "https://opencode.ai/config.json",
+        model,
+        ...(campaign.permissions === undefined
+            ? {}
+            : { permissions: campaign.permissions }),
+    }, null, 2)}\n`, "utf8");
+    return configHome;
+}
+/**
+ * Environment for one headless session. Ambient OpenCode session identity is
+ * removed; credentials and routing arrive only through declared names.
+ * @param base The host environment.
+ * @param options Config home, trial data/cache directories, overlay and names
+ *   whose values are passed through.
+ * @returns A fresh environment object.
+ * @param options.configHome The configHome value.
+ * @param options.dataHome The dataHome value.
+ * @param options.cacheHome The cacheHome value.
+ * @param options.overlay The overlay value.
+ * @param options.passthrough The passthrough value.
+ */
+export function sessionEnv(base, options) {
+    const env = { ...base };
+    for (const key of [
+        "OPENCODE_SESSION_ID",
+        "OPENCODE_TERMINAL",
+        "OPENCODE",
+        "AI_AGENT",
+        "OPENCODE_CONFIG_CONTENT",
+    ]) {
+        delete env[key];
+    }
+    env.HOME = "/tmp/agent-home";
+    env.XDG_CONFIG_HOME = options.configHome;
+    env.XDG_DATA_HOME = options.dataHome;
+    env.XDG_CACHE_HOME = options.cacheHome;
+    if (options.overlay !== null) {
+        env.OPENCODE_CONFIG_CONTENT = options.overlay;
+    }
+    for (const name of options.passthrough) {
+        const value = base[name];
+        if (value !== undefined)
+            env[name] = value;
+    }
+    return env;
+}

package/dist/adapters/podman/container.d.ts

@@ -0,0 +1,62 @@
+import { runCommand, type CommandResult } from "../process.ts";
+/** One bind mount in a trial sandbox. */
+export interface Mount {
+    /** The source value. */
+    source: string;
+    /** The target value. */
+    target: string;
+    /** The read only value. */
+    readOnly: boolean;
+}
+/** The complete sandbox plan for one trial. */
+export interface ContainerPlan {
+    /** The image id value. */
+    imageId: string;
+    /** The mounts value. */
+    mounts: Mount[];
+    /** The workdir value. */
+    workdir: string;
+    /** The network value. */
+    network: "host" | "none";
+    /** The argv value. */
+    argv: string[];
+    /** Environment names passed by reference; values never enter argv. */
+    envNames: string[];
+    /** A 0600 env file read by Podman; values never enter argv. */
+    envFile: string | null;
+    /** The timeout ms value. */
+    timeoutMs: number;
+}
+/**
+ * Validate a mount plan before it reaches Podman: absolute targets, existing
+ * sources, unique targets, and no read-write mount over a read-only one.
+ * @param mounts The proposed mounts.
+ * @returns Problems; empty means the plan is accepted.
+ */
+export declare function mountProblems(mounts: readonly Mount[]): string[];
+/**
+ * The exact Podman argv for one trial. `--userns=keep-id`, a read-only root,
+ * no new privileges, dropped capabilities and a bounded /tmp are the sandbox
+ * floor; network mode is declared honestly, because host networking is not
+ * provider-only isolation.
+ * @param plan The validated plan.
+ * @returns The complete argv after `podman`.
+ */
+export declare function containerArgv(plan: ContainerPlan): string[];
+/**
+ * Run one trial container.
+ * @param plan The validated plan.
+ * @param run Process adapter, injected for tests.
+ * @returns The bounded process result.
+ */
+export declare function runContainer(plan: ContainerPlan, run?: typeof runCommand): Promise<CommandResult>;
+/** The container-side workspace path. */
+export declare const CONTAINER_WORKSPACE = "/workspace";
+/** The container-side config home. */
+export declare const CONTAINER_CONFIG_HOME = "/config-home";
+/** The container-side subject root. */
+export declare const CONTAINER_SUBJECTS = "/subjects";
+/** The container-side journal directory, when docs instrumentation is on. */
+export declare const CONTAINER_JOURNAL = "/journal";
+/** Resolve and normalise all mount sources. */
+export declare function normaliseMounts(mounts: readonly Mount[]): Mount[];

package/dist/adapters/podman/container.js

@@ -0,0 +1,119 @@
+import { existsSync } from "node:fs";
+import { isAbsolute, resolve } from "node:path";
+import { runCommand } from "../process.js";
+/** Check one proposed mount's path syntax and existence. */
+function mountEntryProblems(mount) {
+    const problems = [];
+    if (!isAbsolute(mount.source) || !isAbsolute(mount.target)) {
+        problems.push(`mount ${mount.source} -> ${mount.target} must use absolute paths`);
+    }
+    if (!existsSync(mount.source)) {
+        problems.push(`mount source ${mount.source} does not exist`);
+    }
+    if (mount.target.includes(",")) {
+        problems.push(`mount target ${mount.target} may not contain a comma`);
+    }
+    return problems;
+}
+/** Check for a read-write mount nested under a read-only target. */
+function nestedMountProblems(targets) {
+    const readOnly = [...targets.entries()]
+        .filter(([, value]) => value)
+        .map(([target]) => target);
+    const problems = [];
+    for (const [target, value] of targets) {
+        if (value)
+            continue;
+        if (readOnly.some((parent) => target.startsWith(`${parent}/`))) {
+            problems.push(`read-write mount ${target} sits under a read-only mount`);
+        }
+    }
+    return problems;
+}
+/**
+ * Validate a mount plan before it reaches Podman: absolute targets, existing
+ * sources, unique targets, and no read-write mount over a read-only one.
+ * @param mounts The proposed mounts.
+ * @returns Problems; empty means the plan is accepted.
+ */
+export function mountProblems(mounts) {
+    const problems = mounts.flatMap(mountEntryProblems);
+    const targets = new Map();
+    for (const mount of mounts) {
+        if (targets.has(mount.target)) {
+            problems.push(`duplicate mount target ${mount.target}`);
+        }
+        targets.set(mount.target, mount.readOnly);
+    }
+    problems.push(...nestedMountProblems(targets));
+    return problems;
+}
+/**
+ * The exact Podman argv for one trial. `--userns=keep-id`, a read-only root,
+ * no new privileges, dropped capabilities and a bounded /tmp are the sandbox
+ * floor; network mode is declared honestly, because host networking is not
+ * provider-only isolation.
+ * @param plan The validated plan.
+ * @returns The complete argv after `podman`.
+ */
+export function containerArgv(plan) {
+    const args = [
+        "run",
+        "--rm",
+        "--network",
+        plan.network,
+        "--userns=keep-id",
+        "--read-only",
+        "--cap-drop=ALL",
+        "--security-opt=no-new-privileges",
+        "--tmpfs",
+        "/tmp:rw,nosuid,size=768m",
+    ];
+    for (const mount of plan.mounts) {
+        args.push("--mount", `type=bind,src=${mount.source},dst=${mount.target}${mount.readOnly ? ",ro" : ""}`);
+    }
+    if (plan.envFile !== null) {
+        args.push("--env-file", plan.envFile);
+    }
+    args.push("--workdir", plan.workdir, plan.imageId, ...plan.argv);
+    return args;
+}
+/**
+ * Run one trial container.
+ * @param plan The validated plan.
+ * @param run Process adapter, injected for tests.
+ * @returns The bounded process result.
+ */
+export async function runContainer(plan, run = runCommand) {
+    const problems = mountProblems(plan.mounts);
+    if (problems.length > 0) {
+        return {
+            status: null,
+            signal: null,
+            stdout: "",
+            stderr: problems.join("; "),
+            timedOut: false,
+            error: "invalid mount plan",
+        };
+    }
+    return run("podman", containerArgv(plan), {
+        timeoutMs: plan.timeoutMs,
+        maxBuffer: 64 * 1024 * 1024,
+    });
+}
+/** The container-side workspace path. */
+export const CONTAINER_WORKSPACE = "/workspace";
+/** The container-side config home. */
+export const CONTAINER_CONFIG_HOME = "/config-home";
+/** The container-side subject root. */
+export const CONTAINER_SUBJECTS = "/subjects";
+/** The container-side journal directory, when docs instrumentation is on. */
+export const CONTAINER_JOURNAL = "/journal";
+/** Resolve and normalise all mount sources. */
+export function normaliseMounts(mounts) {
+    return mounts.map((mount) => ({
+        ...mount,
+        source: resolve(mount.source),
+        target: resolve(mount.target),
+    }));
+}

package/dist/adapters/podman/image.d.ts

@@ -0,0 +1,50 @@
+import { runCommand, type CommandResult } from "../process.ts";
+/** The recorded identity and CLI version of one runtime image. */
+export interface ResolvedImage {
+    /** The image value. */
+    image: string;
+    /** The image id value. */
+    imageId: string;
+    /** The opencode version value. */
+    opencodeVersion: string;
+    /** The container cli value. */
+    containerCli: string;
+}
+/** An image inspection, or the observed refusal. */
+export type ImageResolution = {
+    ok: true;
+    image: ResolvedImage;
+} | {
+    ok: false;
+    problem: string;
+};
+/** Locate the package's `container/` directory from source or dist. */
+export declare function containerDirectory(): string;
+/** Extract a version from `opencode --version` output. */
+export declare function parseOpencodeVersion(stdout: string): string | null;
+/**
+ * Resolve a runtime image to the immutable ID and the OpenCode version it
+ * actually contains. A mutable tag alone is never accepted as frozen state.
+ * @param image The image name or ID.
+ * @param declaredVersion The version the campaign declared.
+ * @param run The process adapter, injected for tests.
+ * @returns The resolution, or the refusal.
+ */
+export declare function resolveImage(image: string, declaredVersion: string, run?: typeof runCommand): Promise<ImageResolution>;
+/**
+ * Build the sandbox image from the packaged recipe with explicit inputs. The
+ * recipe does not float: both Node and the OpenCode CLI are build arguments.
+ * @param options The build inputs.
+ * @param options.tag The image tag.
+ * @param options.nodeBase The pinned Node base image.
+ * @param options.opencodeVersion The pinned OpenCode CLI version.
+ * @param run The process adapter.
+ * @returns The build result.
+ */
+export declare function buildImage(options: {
+    tag: string;
+    nodeBase: string;
+    opencodeVersion: string;
+}, run?: typeof runCommand): Promise<CommandResult>;
+/** Read the packaged Containerfile; useful for delivery checks and docs. */
+export declare function containerfileText(): string;

package/dist/adapters/podman/image.js

@@ -0,0 +1,124 @@
+import { existsSync, readFileSync } from "node:fs";
+import { dirname, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { runCommand } from "../process.js";
+/** Locate the package's `container/` directory from source or dist. */
+export function containerDirectory() {
+    const here = dirname(fileURLToPath(import.meta.url));
+    for (const candidate of [
+        resolve(here, "../../../container"),
+        resolve(here, "../../container"),
+        resolve(process.cwd(), "container"),
+    ]) {
+        if (existsSync(join(candidate, "Containerfile")))
+            return candidate;
+    }
+    return resolve(process.cwd(), "container");
+}
+/** Extract a version from `opencode --version` output. */
+export function parseOpencodeVersion(stdout) {
+    const match = /(?:opencode\s+)?v?([0-9]{1,4}\.[0-9]{1,4}\.[0-9]{1,6}(?:[-+][0-9A-Za-z.-]{1,40})?)/.exec(stdout.trim());
+    return match?.[1] ?? null;
+}
+/** Resolve a tag to a normalised immutable image id. */
+async function inspectImageId(image, run) {
+    const inspect = await run("podman", ["image", "inspect", "--format", "{{.Id}}", image], { timeoutMs: 30_000 });
+    if (inspect.status !== 0) {
+        return {
+            ok: false,
+            problem: `cannot inspect image ${image}: ${inspect.stderr.trim() || inspect.error || "unknown error"}`,
+        };
+    }
+    const raw = inspect.stdout.trim();
+    if (!/^(sha256:)?[0-9a-f]{12,64}$/i.test(raw)) {
+        return {
+            ok: false,
+            problem: `image ${image} did not report an immutable id`,
+        };
+    }
+    return { ok: true, id: raw.startsWith("sha256:") ? raw : `sha256:${raw}` };
+}
+/** Read the OpenCode version the image actually contains. */
+async function installedVersion(imageId, run) {
+    const version = await run("podman", [
+        "run",
+        "--rm",
+        "--network",
+        "none",
+        "--entrypoint",
+        "opencode",
+        imageId,
+        "--version",
+    ], { timeoutMs: 60_000 });
+    const observed = parseOpencodeVersion(version.stdout + version.stderr);
+    if (version.status !== 0 || observed === null) {
+        return {
+            ok: false,
+            problem: `image ${imageId} did not report an OpenCode version: ${version.stderr.trim() || version.error || "no output"}`,
+        };
+    }
+    return { ok: true, version: observed };
+}
+/**
+ * Resolve a runtime image to the immutable ID and the OpenCode version it
+ * actually contains. A mutable tag alone is never accepted as frozen state.
+ * @param image The image name or ID.
+ * @param declaredVersion The version the campaign declared.
+ * @param run The process adapter, injected for tests.
+ * @returns The resolution, or the refusal.
+ */
+export async function resolveImage(image, declaredVersion, run = runCommand) {
+    const inspected = await inspectImageId(image, run);
+    if (!inspected.ok)
+        return inspected;
+    const installed = await installedVersion(inspected.id, run);
+    if (!installed.ok)
+        return installed;
+    if (installed.version !== declaredVersion) {
+        return {
+            ok: false,
+            problem: `image ${inspected.id} contains OpenCode ${installed.version}, campaign declares ${declaredVersion}`,
+        };
+    }
+    return {
+        ok: true,
+        image: {
+            image,
+            imageId: inspected.id,
+            opencodeVersion: installed.version,
+            containerCli: "podman",
+        },
+    };
+}
+/**
+ * Build the sandbox image from the packaged recipe with explicit inputs. The
+ * recipe does not float: both Node and the OpenCode CLI are build arguments.
+ * @param options The build inputs.
+ * @param options.tag The image tag.
+ * @param options.nodeBase The pinned Node base image.
+ * @param options.opencodeVersion The pinned OpenCode CLI version.
+ * @param run The process adapter.
+ * @returns The build result.
+ */
+export async function buildImage(options, run = runCommand) {
+    return run("podman", [
+        "build",
+        "--network",
+        "host",
+        "--build-arg",
+        `NODE_BASE=${options.nodeBase}`,
+        "--build-arg",
+        `OPENCODE_VERSION=${options.opencodeVersion}`,
+        "--build-arg",
+        `HOST_UID=${process.getuid?.() ?? 1000}`,
+        "--build-arg",
+        `HOST_GID=${process.getgid?.() ?? 1000}`,
+        "-t",
+        options.tag,
+        containerDirectory(),
+    ], { timeoutMs: 15 * 60_000 });
+}
+/** Read the packaged Containerfile; useful for delivery checks and docs. */
+export function containerfileText() {
+    return readFileSync(join(containerDirectory(), "Containerfile"), "utf8");
+}

package/dist/adapters/process.d.ts

@@ -0,0 +1,38 @@
+/** The bounded result of one child process. */
+export interface CommandResult {
+    /** The status value. */
+    status: number | null;
+    /** The signal value. */
+    signal: NodeJS.Signals | null;
+    /** The stdout value. */
+    stdout: string;
+    /** The stderr value. */
+    stderr: string;
+    /** The timed out value. */
+    timedOut: boolean;
+    /** The error value. */
+    error: string | null;
+}
+/** Limits for one process call. */
+export interface CommandOptions {
+    /** The cwd value. */
+    cwd?: string;
+    /** The env value. */
+    env?: NodeJS.ProcessEnv;
+    /** The timeout ms value. */
+    timeoutMs?: number;
+    /** The max buffer value. */
+    maxBuffer?: number;
+    /** The stdin value. */
+    stdin?: "ignore" | "pipe";
+}
+/**
+ * Run one child process without a shell, bounded in time and output. This is
+ * the only place OTC spawns a process; adapters inject it so ordinary tests
+ * never need Podman or OpenCode.
+ * @param command The executable.
+ * @param args Its argv, verbatim.
+ * @param options Working directory, environment, timeout and capture cap.
+ * @returns The bounded result; a spawn failure is data, not an exception.
+ */
+export declare function runCommand(command: string, args: readonly string[], options?: CommandOptions): Promise<CommandResult>;

package/dist/adapters/process.js

@@ -0,0 +1,71 @@
+import { spawn } from "node:child_process";
+/**
+ * Run one child process without a shell, bounded in time and output. This is
+ * the only place OTC spawns a process; adapters inject it so ordinary tests
+ * never need Podman or OpenCode.
+ * @param command The executable.
+ * @param args Its argv, verbatim.
+ * @param options Working directory, environment, timeout and capture cap.
+ * @returns The bounded result; a spawn failure is data, not an exception.
+ */
+export function runCommand(command, args, options = {}) {
+    const timeoutMs = options.timeoutMs ?? 120_000;
+    const maxBuffer = options.maxBuffer ?? 64 * 1024 * 1024;
+    return new Promise((resolvePromise) => {
+        let settled = false;
+        let timedOut = false;
+        let stdout = "";
+        let stderr = "";
+        let timer = null;
+        const finish = (result) => {
+            if (settled)
+                return;
+            settled = true;
+            if (timer !== null)
+                clearTimeout(timer);
+            resolvePromise({
+                status: result.status ?? null,
+                signal: result.signal ?? null,
+                stdout: result.stdout ?? stdout,
+                stderr: result.stderr ?? stderr,
+                timedOut,
+                error: result.error ?? null,
+            });
+        };
+        let child;
+        try {
+            child = spawn(command, [...args], {
+                cwd: options.cwd,
+                env: options.env,
+                stdio: [options.stdin ?? "ignore", "pipe", "pipe"],
+            });
+        }
+        catch (error) {
+            finish({
+                error: error instanceof Error ? error.message : String(error),
+            });
+            return;
+        }
+        const append = (stream, chunk) => {
+            if (stream === "out") {
+                if (stdout.length < maxBuffer)
+                    stdout += String(chunk);
+            }
+            else if (stderr.length < maxBuffer) {
+                stderr += String(chunk);
+            }
+        };
+        child.stdout?.on("data", (chunk) => append("out", chunk));
+        child.stderr?.on("data", (chunk) => append("err", chunk));
+        child.on("error", (error) => finish({ error: error.message }));
+        timer = setTimeout(() => {
+            timedOut = true;
+            child.kill("SIGTERM");
+            setTimeout(() => {
+                if (!settled)
+                    child.kill("SIGKILL");
+            }, 2_000);
+        }, timeoutMs);
+        child.on("close", (status, signal) => finish({ status, signal, stdout, stderr }));
+    });
+}